Magento CMS Admin Panel Remote Code Execution Vulnerability

Bugtraq ID:	98778
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	May 31 2017 12:00AM
Updated:	May 31 2017 12:00AM
Credit:	Fabain
Vulnerable:	Magento Enterprise Edition 2.1.6 Magento Enterprise Edition 2.1.2 Magento Enterprise Edition 2.0.6 Magento Enterprise Edition 2.0.5 Magento Enterprise Edition 2.0.4 Magento Enterprise Edition 2.0.3 Magento Enterprise Edition 2.0.2 Magento Enterprise Edition 2.0.1 Magento Enterprise Edition 1.14.3.2 Magento Enterprise Edition 1.14.3 Magento Community Edition 2.0.6 Magento Community Edition 2.0.5 Magento Community Edition 2.0.4 Magento Community Edition 2.0.3 Magento Community Edition 2.0.2 Magento Community Edition 2.1.6 Magento Community Edition 2.0.1 Magento Community Edition 1.9.3.2 Magento Community Edition 1.9.3
Not Vulnerable:	Magento Enterprise Edition 2.1.7 Magento Enterprise Edition 2.0.14 Magento Enterprise Edition 1.14.3.3 Magento Community Edition 2.1.7 Magento Community Edition 2.0.14 Magento Community Edition 1.9.3.3

Magento CMS Admin Panel Remote Code Execution Vulnerability

Magento CMS is prone to a remote code-execution vulnerability.

Successfully exploiting this issue may allow an attacker to execute arbitrary code in the context of the affected application. Failed exploit attempts may cause a denial-of-service condition.

The following products are affected:

Versions prior to Magento Community Edition 2.0.14, 2.1.7 and 1.9.3.3.
Versions prior to Magento Enterprise Edition 2.0.14, 2.1.7 and 1.14.3.3.

Magento CMS Admin Panel Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.